This notice describes how the personal data of users who interact with this website (https://bikeandhikeitalia.com/en/) is processed. It is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and applies only to this website, not to any other websites that may be reached through hyperlinks. Processing is based on the principles of lawfulness, fairness, transparency and data minimisation (Art. 5 GDPR).
1. Data Controller
Apulia Bike Tours
The Controller is the party that determines the purposes and means of processing the personal data collected through this website. For any request concerning your data, including exercising the rights listed in §6, you can use the contact details published on the contact page.
2. Types of data collected and purposes
The personal data collected by this website includes the data needed to provide the services you use. Data is processed only to the extent strictly necessary for the purposes listed below, grouped by category. The list reflects the services actually active on this website: should additional third-party tools be activated in the future, this notice will be updated and, for statistical or marketing purposes, they will only be activated with your prior consent.
Purposes necessary for the website to work
- Website browsing (technical cookies)
- Storing cookie consent
- Contact form
- Anti-spam protection for forms
- Contact by email
- Contact by phone
- WordPress platform
- Website virtual assistant
3. Methods and place of processing
Methods. The Controller takes appropriate technical and organisational security measures to prevent unauthorised access, modification, disclosure or destruction of data. Processing is carried out using IT and/or telematic tools, in ways strictly related to the stated purposes.
Legal basis. Each processing operation is based on a specific legal basis, set out in detail in §4: performance of a contract or of pre-contractual measures (Art. 6.1.b), compliance with a legal obligation (Art. 6.1.c), legitimate interest of the Controller (Art. 6.1.f) or consent of the data subject (Art. 6.1.a). Where processing is based on consent, consent can be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
Place. Data is processed at the Controller's operational headquarters and at the data centres of the providers listed in §4. For any transfers to third countries, see §5.
Retention period. Data is kept only for as long as strictly necessary to achieve the purposes for which it was collected, according to the specific periods indicated for each service in §4 and in compliance with applicable legal obligations. Afterwards, the data is deleted or anonymised.
4. Details of the active services
For each service active on this website we state the purpose, the data processed, the legal basis, the retention period, any external processors and the link to their privacy notice.
Purposes necessary for the website to work
Website browsing (technical cookies)Necessary
Cookies strictly necessary for the website to work: user session, security, preferences. Stored on your device and not shared with third parties.
Data processed: Session ID, technical cookies, IP address (in server logs)
Legal basis: Legitimate interest of the Controller (Art. 6.1.f GDPR): necessary for the requested service
Retention: Browser session; server logs: 30 days
Storing cookie consentNecessary
We store your choices on the cookie banner so we do not show it to you again on every visit.
Data processed: Opaque consent identifier (UUID), accepted categories, date/time, hashed IP (for the consent log, Art. 7 GDPR)
Legal basis: Performance of a service requested by the data subject (Art. 6.1.b GDPR) + the Controller's obligation to demonstrate consent (Art. 7.1 GDPR)
Retention: Local cookie: 6 months. Server consent log: 24 months (configurable).
Contact formNecessary
When you fill in a contact form on the website, we collect the data you enter so that we can reply to you.
Data processed: Name, email, phone number (if provided), message subject, message content, sender's IP address (anti-spam)
Legal basis: Performance of pre-contractual measures at the data subject's request (Art. 6.1.b GDPR)
Retention: For as long as needed to reply to the request, and in any case no longer than 24 months after the last contact
External processors: Processed directly by the Controller (own server). Emails may be sent through an SMTP service (see below).
Anti-spam protection for formsNecessary
The website's forms (contact, login, registration) are protected by a built-in anti-spam system that checks that a submission is genuine WITHOUT sending data to third-party services: it uses server-side techniques (a hidden trap field, a check on how long the form took to fill in, a proof-of-work run by your browser) and, if needed, a simple verification question. No external service, no third-party cookies, no IP address shared outside.
Data processed: Technical metadata of the form submission (time taken to fill it in, result of the anti-bot checks). No personal data is passed on to third parties.
Legal basis: Legitimate interest (Art. 6.1.f GDPR): website security and prevention of spam and automated abuse of forms.
Retention: Technical metadata is not kept beyond the processing of the form submission.
External processors: Processed directly by the Controller on its own server. No external processor.
Contact by emailNecessary
When you write to us directly by email (including by clicking a mailto: address on the website), we collect your email address and the content of your message so that we can reply to you.
Data processed: Sender's email address, subject, message content, any attachments
Legal basis: Performance of pre-contractual measures at your request (Art. 6.1.b GDPR)
Retention: For as long as needed to handle the request, and in any case no longer than 24 months after the last contact
Contact by phoneNecessary
When you call us, we may note down the details you give us during the call (name, reason for contacting us, any technical details) in order to handle your request.
Data processed: Phone number (if shown by caller ID), handwritten notes on the content of the conversation
Legal basis: Performance of pre-contractual measures at your request (Art. 6.1.b GDPR)
Retention: For as long as needed to handle the request, and in any case no longer than 24 months
WordPress platformNecessary
The website is built on the open-source WordPress platform (wordpress.org). WordPress handles sessions, authentication and content internally, without sending data to third parties.
Data processed: Technical session and preference cookies (see "Website browsing"); IP in the server logs
Legal basis: Legitimate interest (Art. 6.1.f GDPR): necessary for the requested service
Retention: Browser session; server logs: 30 days
Website virtual assistantNecessary
Help chat that answers using the content published on this website. Questions and answers are kept so that requests can be followed up and the service improved. Processing takes place on GAW Digital Solutions infrastructure and, only to generate the answer, through Anthropic. No advertising profile is used and conversations are not used to train models.
Data processed: Text of the messages written by the visitor, page language, a temporary session ID (not linked to a person) and, if the visitor writes them, name, email or references to their request.
Legal basis: Legitimate interest (Art. 6.1.f GDPR) in answering requests for help; performance of pre-contractual measures (Art. 6.1.b) when the conversation concerns a booking request.
Retention: 12 months from the conversation, then automatic deletion. Booking reference codes are not stored in plain text.
External processors: GAW Digital Solutions (Italy); Anthropic PBC (USA, standard contractual clauses) only to generate the answer
Provider's privacy notice: https://www.anthropic.com/legal/privacy
5. Transfers of data to non-EU countries
Based on the services currently active on this website, no personal data is transferred to non-EU countries: the providers used operate through entities based in the European Union.
6. User rights (Chapter III GDPR)
As a data subject you have the right to:
- Access (Art. 15): obtain confirmation of processing and a copy of your data;
- Rectification (Art. 16): correct inaccurate data or complete incomplete data;
- Erasure or "right to be forgotten" (Art. 17), within the limits set by law;
- Restriction of processing (Art. 18);
- Portability of data (Art. 20): receive it in a structured, machine-readable format;
- Objection (Art. 21), in particular to processing based on legitimate interest;
- Withdrawal of consent (Art. 7.3) at any time, without affecting the lawfulness of processing carried out before withdrawal.
To exercise one or more of these rights, you can use the contact details published on the contact page. You will receive a reply within 30 days, which may be extended to 60 for complex requests with an appropriate explanation.
7. Complaint to the supervisory authority
You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) (Piazza Venezia, 11, 00187 Rome, Italy; gpdp.it) if you believe that the processing of your personal data infringes the Regulation.
8. Cookies and managing your preferences
This website uses cookies and similar technologies. For the full list, purposes and durations, see the Cookie Policy.
To change or withdraw at any time your cookie preferences, click the button with the 🍪 icon that you will find at the bottom left of every page of the website: it reopens the consent management panel.
9. Consent log (Art. 7 GDPR)
For processing based on consent, the Controller keeps a consent log on the server that stores, in pseudonymised form (IP address and user agent hashed with salted SHA-256), the date and time, an opaque consent identifier, the accepted categories and the version of the policy displayed. Retention: 24 months. You can ask for information about your consent record by writing to the Controller's address.
10. Control of and responsibility for processing
The Controller named in §1 is the sole controller of and party responsible for the processing of the personal data collected through this website, as well as for the purposes, the choices and configuration of the tools used, and the accuracy of this notice. The software and technical tools used to manage cookies, consent and security are provided as tools designed to support compliance with current legislation: correct configuration, constant updating and compliance with legal obligations remain the Controller's responsibility. The provider of the technical tools is neither controller nor processor of the data of this website.
Last updated: 19/10/2026 · Policy version: c1cc3aea3c.